Buggy code:
public abstract class EJBComponent extends BasicComponent { private static final Logger log = Logger . getLogger ( EJBComponent . class ) ; private static final ApplicationExceptionDetails APPLICATION_EXCEPTION = new ApplicationExceptionDetails ( "java.lang.Exception" , true , false ) ; private final Map < MethodTransactionAttributeKey , TransactionAttributeType > txAttrs ; private final EJBUtilities utilities ; private final boolean isBeanManagedTransaction ; private final Map < Class < ? > , ApplicationExceptionDetails > applicationExceptions ; private final EJBSecurityMetaData securityMetaData ; private final Map < String , ServiceName > viewServices ; private final ServiceName ejbLocalHome ; private final ServiceName ejbHome ; private final TimerService timerService ; protected final Map < Method , InterceptorFactory > timeoutInterceptors ; private final Method timeoutMethod ; private final String applicationName ; private final String moduleName ; private final String distinctName ; private final EJBRemoteTransactionsRepository ejbRemoteTransactionsRepository ; protected EJBComponent ( final EJBComponentCreateService ejbComponentCreateService ) { } protected < T > T createViewInstanceProxy ( final Class < T > viewInterface , final Map < Object , Object > contextData ) { } protected < T > T createViewInstanceProxy ( final Class < T > viewInterface , final Map < Object , Object > contextData , final ServiceName serviceName ) { } public ApplicationExceptionDetails getApplicationException ( Class < ? > exceptionClass , Method invokedMethod ) { } public Principal getCallerPrincipal ( ) { } protected TransactionAttributeType getCurrentTransactionAttribute ( ) { } public EJBHome getEJBHome ( ) throws IllegalStateException { } public EJBLocalHome getEJBLocalHome ( ) throws IllegalStateException { } public boolean getRollbackOnly ( ) throws IllegalStateException { } public SimpleSecurityManager getSecurityManager ( ) { } public TimerService getTimerService ( ) throws IllegalStateException { } @ Deprecated public TransactionAttributeType getTransactionAttributeType ( Method method ) { } public TransactionAttributeType getTransactionAttributeType ( MethodIntf methodIntf , Method method ) { } public TransactionManager getTransactionManager ( ) { } public TransactionSynchronizationRegistry getTransactionSynchronizationRegistry ( ) { } public int getTransactionTimeout ( Method method ) { } public UserTransaction getUserTransaction ( ) throws IllegalStateException { } private boolean isBeanManagedTransaction ( ) { } public boolean isCallerInRole ( final String roleName ) throws IllegalStateException { <START_BUG> return utilities . getSecurityManager ( ) . isCallerInRole ( roleName ) ; <END_BUG> } public Object lookup ( String name ) throws IllegalArgumentException { } public void setRollbackOnly ( ) throws IllegalStateException { } public EJBSecurityMetaData getSecurityMetaData ( ) { } public TimedObjectInvoker getTimedObjectInvoker ( ) { } public Method getTimeoutMethod ( ) { } public String getApplicationName ( ) { } public String getDistinctName ( ) { } public String getModuleName ( ) { } public EJBRemoteTransactionsRepository getEjbRemoteTransactionsRepository ( ) { } }

Fix:
return utilities . getSecurityManager ( ) . isCallerInRole ( securityMetaData . getSecurityRoles ( ) , roleName ) ;